[SaulMoro]

Summary

Follow-up to #1201. That PR took a workflow's teamRevision only from the current HEAD. When HEAD moved to an unpushed commit that did not touch the workflow, the next pull or push rewrote the cache entry without its revision. The run then published no teamRevision, although the earlier commit still holds those bytes and origin still reaches it. This is the normal state in self mode, where .teamai/ lives in the project repo.

 syncWorkflowDefinitions
   kept loop: drop every cached revision origin no longer reaches
   for each valid file
-    previous = readCache(name)
-    write { teamRevision: file.teamRevision }            # HEAD only
+    previous = kept.get(stem)                            # already cleaned
+    teamRevision = file.teamRevision
+      ?? (previous.sourceHash == file.sourceHash ? previous.teamRevision : none)
+    write { teamRevision }

An equal sourceHash means equal bytes. The kept loop already removed any earlier revision that origin does not reach, so a carried revision always stores the cached bytes and is reachable. A test now pins this ordering.

Also from the #1201 review:

• remotelyReachableRevision resolves HEAD with getHeadCommit, the helper [feat] Record the agent each workflow step ran as #1176 and [feat] Run benchmark suites as workflows #1180 use for the team commit.
• The reports-branch e2e checks cat-file -e and git show in a fresh clone of origin, not in the clone that produced the value.
• A new test checks that a run of a kept workflow records the earlier revision. The feat(workflow): record team revision #1201 review listed this as the one untested criterion. It is coverage only, and it passes without this fix.

Evidence

• Before: keeps a verified revision when an unrelated unpushed commit moves HEAD fails on main:

  FAIL  src/__tests__/workflow-cache.test.ts > workflow cache > keeps a verified revision when an unrelated unpushed commit moves HEAD
  - Expected: "<pushed commit>"
  + Received: undefined
  

  Real CLI, built from main. Self mode, teamai pull, an unrelated local commit, then teamai pull and teamai workflow start verify --driver local:

  pushed commit:          3a4f5665894159a4f3c72b6a89b5c8470c27a167
  after pull at pushed:   3a4f5665894159a4f3c72b6a89b5c8470c27a167
  after unpushed commit:  undefined
  {"data":{"done":{"run":"r9c949e95a24ee1b3","outcome":"succeeded","record":"published"},"cancelled":[]}}
  published record:       {"phase":"end","sourceHash":"b3b17abc…896e"}
  

  After: the same script on this branch:

  pushed commit:          d135a448b4eebbad49a42a6b75b33a4bbad0da20
  after pull at pushed:   d135a448b4eebbad49a42a6b75b33a4bbad0da20
  after unpushed commit:  d135a448b4eebbad49a42a6b75b33a4bbad0da20
  {"data":{"done":{"run":"r7c824b0797776526","outcome":"succeeded","record":"published"},"cancelled":[]}}
  published record:       {"phase":"end","sourceHash":"b3b17abc…896e","teamRevision":"d135a448b4eebbad49a42a6b75b33a4bbad0da20"}
  

• drops an unchanged workflow revision that the team remote no longer reaches fails when the kept loop cleans only invalid files (1 failed, 172 passed). It passes with the code as it is.

• npx vitest run src/__tests__/workflow-cache.test.ts src/__tests__/workflow-records.test.ts: 216 passed. npx tsc --noEmit and npm run lint are clean.

• npm run test:e2e -- src/__tests__/e2e/workflow-records-reports-branch-1083.test.ts: 1 passed.

• I did not run the full npx vitest run locally. CI covers it, along with the other providers and agents.

Merge Danger

Door: two-way

Only the cache write path changes. Records keep the same shape. Reverting returns to the earlier behavior, which omits the revision.

Blast Radius: narrow

Workflow cache entries and the teamRevision of run records. A run can now publish a revision in a case where it used to publish none. The revision still has to be reachable from origin and store the exact bytes.

[github-actions]

No findings in the specified diff.

The PR description includes sufficient testing: a representative real-CLI before/after record, targeted unit tests, type checking, lint, and a reports-branch e2e run. Additional provider/agent coverage is explicitly deferred to CI.

Review was read-only; I did not run, build, or install anything from the PR.